Vibe coding workflows and disciplined AI-assisted engineering
Explore specification-driven AI code generation, hallucination debugging, context curation across large-window models, and automated test-driven verification.
Vibe coding is an emerging paradigm where developers steer AI assistants to write, refactor, and debug software through natural language prompts and rapid iterative feedback. While casual vibe coding leans heavily on intuition, visual inspection, and conversational steering without manual code inspection, robust engineering elevates this into disciplined AI-assisted development: pairing rapid LLM generation with rigorous automated unit testing, strict type checking, linting, and critical code review to prevent silent regressions and security vulnerabilities.
Key concepts
Prompt-to-Code Workflow
The core vibe coding workflow involves: (1) Writing a clear specification or intent, (2) Having the AI generate initial code, (3) Reviewing output for correctness and security, (4) Iteratively refining through follow-up prompts. Effective practitioners develop skills in writing precise specifications, identifying subtle bugs in AI output, and knowing when to accept vs. reject suggestions. Tools like GitHub Copilot, Cursor, and Claude Code each offer different interaction models-inline suggestions, chat-based generation, or agentic file manipulation.
Specification Writing for AI
Writing specs for AI differs from traditional documentation. Key elements include: explicit input/output examples, edge case enumeration, constraint specification (performance, memory, security), and context about surrounding codebase. A well-written spec might read: 'Create a function that validates email addresses. Accept user@domain.tld format. Reject consecutive dots, special characters in local part except . _ + -. Return {valid: boolean, error?: string}. Must handle 10K validations/second.' The more precise the spec, the less iteration needed.
Reviewing AI-Generated Code
AI code review requires skepticism. Common issues include: hallucinated APIs (methods that don't exist), subtle logic errors in edge cases, security vulnerabilities (SQL injection, XSS), hardcoded values instead of configuration, missing error handling, and over-engineering. Reviewers should: run tests immediately, check imports against actual dependencies, trace data flow for logic errors, and validate against the original spec. Tools like ESLint, TypeScript, and unit tests catch many issues, but human judgment remains essential for security and architectural decisions.
Iterative Refinement Patterns
Vibe coding rarely produces perfect code in one shot. Effective patterns include: 'Fix this specific bug' (targeted correction), 'Add error handling for X case' (incremental improvement), 'Refactor for readability' (non-functional improvement), 'Explain why this might fail' (proactive debugging), and 'Write tests for this' (validation). Each iteration should have a clear goal. Over-iteration (fixing non-problems) wastes time; under-iteration (accepting first output) risks bugs. The optimal number depends on code complexity and stakes.
Context Management in Large-Window Architectures
Modern AI developer assistants operate on large context windows (128K to 2M tokens across models like GPT-4o, Claude 3.5/3.7, and Gemini 1.5/2.0 Pro). However, despite expanded window capacity, effective context curation remains vital to combat 'needle-in-a-haystack' retrieval degradation and high latency. Best practices include: referencing specific files/functions rather than dumping whole repositories, utilizing repository indexing (@file, @folder, or vector index), compacting conversational history prior to critical multi-file generation, and maintaining project memory via persistent instructions (such as CLAUDE.md or .cursorrules).
Trust Calibration
Knowing when to trust AI output is a meta-skill. High-trust scenarios: well-known patterns (CRUD operations), standard library usage, repetitive boilerplate, and test case generation. Medium-trust: business logic translation, refactoring suggestions, and documentation writing. Low-trust: novel algorithms, security-critical code, performance optimization, and unfamiliar domains. Trust should increase with: passing tests, matching documentation, linting cleanly, and following established patterns in the codebase. Trust should decrease with: unusual imports, overly complex solutions, and code that 'looks right' but wasn't explicitly tested.
Tool-Specific Patterns
Different tools have different strengths. GitHub Copilot excels at inline completion and following patterns from nearby code-best for extending existing code. Cursor combines chat with file editing and codebase context-best for exploration and multi-file changes. Claude Code offers agentic file manipulation with tool use-best for complex tasks like debugging, refactoring, and test generation. Choosing the right tool for the task improves outcomes: Copilot for speed, Cursor for discovery, Claude Code for complexity. Many practitioners use multiple tools in combination.
Debugging AI-Generated Code
When AI code fails, debugging strategies differ from traditional debugging. First, share the error message and relevant code with the AI for diagnosis. AI often identifies issues faster than manual tracing. If AI can't fix it, try: simplifying the problem (minimal reproduction), checking assumptions (AI may have misinterpreted the spec), and examining generated tests (they reveal AI's understanding). Common AI-specific bugs: wrong library version assumptions, misnamed variables across files, and logic that works for the given example but not edge cases. Always validate fixes with new test cases.
Worked examples
Example 1
You prompt an AI assistant: 'Write a function to calculate the factorial of a number.' It returns:
function factorial(n) {
return n <= 1 ? 1 : n * factorial(n - 1);
}
What issues should you check before accepting this code?
Solution
Step 1: Check input validation. The function doesn't handle negative numbers or non-integer inputs. For n < 0, it returns 1 (incorrect). For n = 1.5, it returns 1.5 instead of rejecting an input for which the usual integer factorial is undefined.
Step 2: Check for potential stack overflow. Large n (e.g., 100000) will cause stack overflow due to recursion depth.
Step 3: Check type safety. In JavaScript/TypeScript, Number.MAX_SAFE_INTEGER is 9,007,199,254,740,991 (about 9 quadrillion). The exact value of 18! is 6,402,373,705,728,000, while 19! exceeds the safe-integer range. Some larger factorials remain exactly representable, but Number does not guarantee exact integer arithmetic beyond that range. Use BigInt when exact large factorials are required.
Step 4: Check the spec match. The original prompt was vague-it didn't specify language, error handling, or range expectations.
Answer: Issues include: (1) No input validation for negatives/non-integers, (2) Stack overflow risk for large n, (3) Results beyond the safe-integer range for n > 18 in JavaScript, (4) Missing spec clarity-should have specified requirements first. Either fix the code or refine the spec before accepting.
Example 2
You're using Cursor to generate a React component. The AI produces code that uses a custom hook 'useUserData' that doesn't exist in your codebase. What is this phenomenon called, and how do you handle it?
Solution
Step 1: Identify the phenomenon. This is 'hallucination'-the AI invented an API that doesn't exist, likely trained on codebases that did have such a hook.
Step 2: Check for alternatives. The hook might exist under a different name. Search your codebase for similar functionality: user data fetching, authentication context, or React Query wrappers.
Step 3: Decide on a resolution path:
- If similar functionality exists: Ask AI to 'refactor to use [actual hook/API]'
- If no equivalent: Ask AI to 'implement the useUserData hook' or 'use standard approach instead'
- If the generated approach is better: Create the hook, but review its implementation carefully
Step 4: Add the missing dependency. If creating the hook, ensure it handles loading states, error states, and caching appropriately.
Answer: This is hallucination. Resolution options: (1) Replace with existing equivalent API, (2) Have AI implement the missing hook (review carefully), or (3) Request a standard library approach instead. Always verify generated imports against your actual dependencies.
Example 3
You've iteratively refined AI-generated code through 8 rounds of prompts. Each time, the AI fixed one issue but introduced another. Describe a strategy to break this cycle.
Solution
Step 1: Recognize the pattern. The 'whack-a-mole' iteration pattern suggests the AI lacks a coherent model of requirements-it's patching locally without global understanding.
Step 2: Reset with comprehensive context. Instead of incremental fixes, provide:
- Complete specification with all requirements explicit
- All edge cases enumerated
- Relevant existing code as context
- Test cases that define success
Step 3: Request a complete rewrite. 'Rewrite this function from scratch considering all these requirements: [list]. Include input validation, error handling, and these test cases.'
Step 4: Validate comprehensively. Run all tests, check edge cases, compare against the full spec-not just the most recent fix.
Step 5: If issues persist, decompose. Break the problem into smaller, independent pieces that AI can handle correctly, then compose results.
Answer: Break the cycle by: (1) Halting incremental fixes, (2) Providing complete context and specification, (3) Requesting a fresh rewrite, (4) Validating against the full requirement set, not just the last fix. Iteration limit: 3-4 rounds before considering a reset.
Example 4
Evaluate this statement: 'AI-generated code is secure because the AI was trained on production codebases.' Identify the flaw in reasoning.
Solution
Step 1: Examine the premise. Production codebases contain both secure and insecure code. Training data includes vulnerabilities, deprecated patterns, and legacy code.
Step 2: Identify common security issues in AI output:
- SQL injection: String concatenation for queries
- XSS: Unescaped user input in HTML
- Hardcoded secrets: API keys in source
- Insecure defaults: Missing authentication checks
- Outdated patterns: MD5 for hashing, HTTP instead of HTTPS
Step 3: Consider training data skew. Popular patterns are overrepresented. If a vulnerable pattern is common in training data, AI will suggest it.
Step 4: Recognize the absence of security intent. AI predicts likely code, not secure code. It has no concept of 'attacker' or 'threat model.'
Answer: The flaw is assuming training on production code implies security. Production code contains vulnerabilities, and AI predicts probable continuations-not secure ones. AI-generated code requires the same security review as human code: input validation, output encoding, authentication checks, secret management, and dependency auditing. Never trust AI output for security-critical code without thorough review.
Representative solved questions
See the kind of question in this topic before opening the full practice set.
Question 1
A developer asks AI to 'fix the bug in this function' without describing the bug. What is the most likely outcome?
Answer: C. AI may make incorrect assumptions about the bug and create new issues
ExplanationStep 1: Without bug description, AI has no success criteria.
Step 2: AI might guess at problems that don't exist.
Step 3: Changes made without understanding can introduce new bugs.
Answer: AI may make incorrect assumptions about the bug and create new issues.
Sources and review notes
This is an AISEA-authored practice question.
Review status: accepted · Reviewed 2026-08-13 · structure and answer-key checks, editorial quality checks, duplicate screening
Question 2
You ask AI to generate a REST API endpoint. The generated code uses a deprecated authentication method. What should you do?
Answer: D. Request the AI to update using current authentication best practices and verify the changes
ExplanationStep 1: Deprecated methods have known security or compatibility issues.
Step 2: The same AI session can often correct its output when guided.
Step 3: Always verify the updated code against current documentation.
Answer: Request the AI to update using current authentication best practices and verify the changes.
Sources and review notes
This is an AISEA-authored practice question.
Review status: accepted · Reviewed 2026-08-13 · structure and answer-key checks, editorial quality checks, duplicate screening
Question 3
What is 'code interpolation' in AI-assisted coding?
Answer: C. AI understanding and generating code that bridges multiple files or modules
ExplanationStep 1: Code interpolation involves cross-file understanding.
Step 2: The AI generates code that correctly references and uses other modules.
Step 3: This requires the AI to have context about the broader codebase.
Answer: AI understanding and generating code that bridges multiple files or modules.
Sources and review notes
This is an AISEA-authored practice question.
Review status: accepted · Reviewed 2026-08-13 · structure and answer-key checks, editorial quality checks, duplicate screening
Common mistakes and useful habits
- Write specifications before generating code. A vague prompt ('write a login function') produces vague code. A precise prompt ('write a login function that accepts email/password, uses bcrypt for hashing, returns {success, token?, error?}, and logs failed attempts') produces targeted code requiring fewer iterations.
- Never accept the first output for non-trivial code. At minimum: run tests, check imports, and trace the happy path. For security-critical code: also trace error paths, check input validation, and review for hardcoded values.
- Use AI to generate tests alongside code. Ask: 'Write unit tests for this function including edge cases.' Tests reveal the AI's understanding of the spec and catch bugs you might miss. However, review tests too-they can be wrong in ways that match wrong code.
- Learn your tool's context mechanics. In Cursor, use @file to include specific files. In Copilot, keep relevant code visible in the editor. In Claude Code, use CLAUDE.md for persistent context. Providing too little context causes hallucination; providing too much causes confusion.
- Develop a 'first pass' review checklist: (1) Do all imports exist in your dependencies? (2) Does the code match the spec's input/output? (3) Are there obvious edge case failures? (4) Does it pass linting/type checking? (5) Do generated tests actually pass? Quick checks catch 80% of issues.
- When AI code works but you don't understand why, don't commit it. Either have the AI explain the logic until you understand, or rewrite it yourself. Code you don't understand is unmaintainable code-future you (or teammates) will struggle with bugs AI can't help with.
Sources and review notes
Reviewed by AISEA Editorial Desk on 7 Nov 2026.
- Distinguished casual prompt-and-run vibe coding from robust AI-assisted software engineering.
- Updated context window specifications to modern frontier benchmarks (128K to 2M tokens).
- Reinforced automated unit testing, type safety, and lint verification gates.
- Code Generation Best Practices with Frontier ModelsAnthropic Documentation · Checked 7 Nov 2026Supports: Context management, iterative prompting, and automated test-driven validation.
- Prompt Engineering and Context Curation for DevelopersSimon Willison Weblog · Checked 7 Nov 2026Supports: Analysis of vibe coding origins, tool dynamics, and verification rigor.
Ready to test your understanding?
Work through 100 questions with explanations after each answer.